bnxt: multiple issues found with GCC analyzer

https://bugs.dpdk.org/show_bug.cgi?id=2113

            Bug ID: 2113
           Summary: bnxt: multiple issues found with GCC analyzer
           Product: DPDK
           Version: 26.11
          Hardware: All
                OS: All
            Status: UNCONFIRMED
          Severity: major
          Priority: Normal
         Component: ethdev
          Assignee: [email protected]
          Reporter: [email protected]

Target Milestone: ---

10. net/bnxt: double free in tfc_msg error path
Component: ethdev | Severity: major | Confidence: confirmed

tfc_msg_alloc_dma_buf() (drivers/net/bnxt/tf_core/v3/tfc_msg.c:151) frees buf->va_addr at :160 when rte_mem_virt2iova() fails and leaves the pointer set. Every caller then goes to cleanup: and calls tfc_msg_free_dma_buf() (:176), freeing it again. Callers: tfc_msg_idx_tbl_alloc_set, tfc_msg_idx_tbl_set, tfc_msg_idx_tbl_get, tfc_msg_tcam_alloc_set, tfc_msg_tcam_set.

11. net/bnxt: tfc_msg_idx_tbl_set() allocates the DMA buffer twice
Component: ethdev | Severity: normal | Confidence: confirmed

drivers/net/bnxt/tf_core/v3/tfc_msg.c:647 calls tfc_msg_alloc_dma_buf(&buf, data_size) unconditionally, and :653 calls it again inside if (req.data_size >= sizeof(req.dev_data)). The first buffer is overwritten and leaked on every DMA-sized set.

12. net/bnxt: uninitialised rxcmp1 used in compressed CQE SSE Rx
Component: ethdev | Severity: major | Confidence: confirmed

crx_burst_vec_sse() declares __m128i rxcmp1[] at drivers/net/bnxt/bnxt_rxtx_vec_sse.c:448 and passes it to crx_descs_to_mbufs() (:498) without ever writing it. GET_DESC_FIELDS (:51) blends rxcmp1 into the vlan_tci word of rx_descriptor_fields1, so every mbuf on this path gets stack garbage in vlan_tci.

13. net/bnxt: leaks in bnxt_alloc_ctx_mem_blk() error paths
Component: ethdev | Severity: minor | Confidence: single pass

drivers/net/bnxt/bnxt_ethdev.c: ctx_pg_arr (:5043) leaks when the ctx_dma_arr allocation fails (:5050), and ctx_dma_arr leaks when rte_memzone_reserve fails (:5096). bnxt_free_ctx_mem() does not recover them because BNXT_CTX_FLAG_INITED is not set.

14. net/bnxt: NULL check after dereference in bnxt_free_ctx_mem()
Component: ethdev | Severity: trivial | Confidence: confirmed

drivers/net/bnxt/bnxt_ethdev.c:5194-5196 dereferences bp->ctx->tqm_mem[i] twice and then tests it for NULL. The check is dead or the dereference is wrong.

You are receiving this mail because:
You are the assignee for the bug.